A Note from Andy Larin, CEO
Phishing is still the primary way cybercriminals get into business networks—and it's not going anywhere. What is changing is the sophistication and methodology of the attacks.
For years, the advice was simple: watch for spelling mistakes, suspicious senders, and urgent subject lines. Today, it's dangerously out of date. AI tools have made phishing emails grammatically flawless, professionally formatted, and eerily personalized. Many "red flags" your team was trained to spot no longer exist.
That's why I want to be direct: if your last cybersecurity awareness training happened more than a year or two ago, it’s time to update. Otherwise, your team won’t be prepared against threats that have fundamentally changed.
This month, we'll start the education upgrade process by zeroing in on one modern phishing technique that catches even security-aware businesses off guard: contact form phishing. It's a technique that’s more convincing than most people expect.
Here's to staying one step ahead,
Featured Article
A “Contact Us” Form Can Be Like a Back Door. Here's How Criminals Use It.
Think you've gotten good at spotting phishing emails? That's great to hear. But the bad guys are always innovating to catch you off guard—and one of their most effective new methods has nothing to do with your inbox at all.
This attack starts with your website's Contact Us form. And what makes it so dangerous is that you're the one who initiates the email contact.
The Reverse-Phish
Instead of sending you an email or text and hoping you’ll click, the attacker submits an inquiry through your contact form. Your team sees it, assumes it's a sales lead, and replies. Now the attacker has something traditional phishing rarely earns upfront: a real email thread, started by you. We like to call this a "reverse-phish”—and the name earns its keep.
How It Unfolds
- The inquiry lands.
The attacker fills out your website Contact Us form with a polished, believable message that bypasses spam filters completely. - Your team responds.
Thinking it's a genuine prospect, someone replies—and the attacker instantly gains credibility. You reached out first. - Trust is built slowly.
Over days or even weeks, the attacker keeps the conversation going—showing interest in your services, acting like a serious potential partner. - The document trap is set.
The attacker suggests moving forward and sends an NDA or business document—typically a ZIP archive. It's malware. - The malware runs silently.
Opening the file launches malicious code designed to harvest credentials, install a backdoor, or begin staging a ransomware attack.
Why It Works
Three things make this attack unusually effective:
- You initiated the exchange, creating a stronger sense of trust.
- The attacker is patient—cultivating a relationship instead of urgent “click this link” tactics.
- It mimics your normal sales process. By the time the malicious file arrives, it feels like the next logical step in a legitimate conversation.
Any business with a contact form is a potential target—regardless of size or industry.
The good news? You can defend yourself. See this month's Bulletproof Your Business section for three practical steps your team can take starting today.
Tech Tip
Before You Click, Hover
Here's one of the easiest phishing detection habits you can build—and it works on virtually every device. Before clicking a link in an email, hover your mouse over it without clicking. In the bottom corner of your browser or email client, the actual destination URL will appear.
What you're looking for: does the address match where the link claims to be taking you? Remember that a hyperlink can be made to display anything. What matters is where it actually goes. A link that says "www.greatstore[.]com" but points to somewhere else is a red flag. Legitimate links from real businesses go to real, recognizable domains.
A quick hover before you click takes about one second and could save your business a serious headache. Just remember that it’s a first check—not an ironclad defence.
On mobile? Press and hold the link instead of tapping—most devices will show you the full URL before you commit to opening it.
Goal: Make "hover before you click" a team habit. Share this tip at your next staff meeting—it's one of the simplest, most effective phishing defences available.
Eye On A.I.
Phishing Is Now a Product. The FBI Just Shut Down One of Its Biggest Suppliers.
The FBI and Google recently dismantled Outsider Enterprise –a China-based, AI-assisted Phishing-as-a-Service (PhaaS) platform coordinated through Telegram.
It operated like a criminal franchise: attackers paid for ready-made kits impersonating well-known brands, picked their targets, and hit send. No technical skill required. The scale over three years:
- 3.8 million credit cards stolen
- $1.9 billion in estimated losses
- 9,000 fake websites and 1M+ malicious URLs
- Victims in 54+ countries
And for every platform taken down, others pop up. PhaaS has industrialized phishing by lowering the skill barrier and dramatically increasing the volume of attacks businesses face every day.
The Bottom Line: Phishing is no longer a craft—it's a commodity. The attacks reaching your inbox, your phone, and yes, your Contact Us form are automated, AI-assisted, and produced at scale. Updated awareness and layered defences are vital.
Bulletproof Your Business
How to Defend Against Contact Form Phishing: 3 Practical Steps
Contact form phishing works because it exploits routine business behaviour—responding to inquiries, exchanging documents, building new relationships. The good news? It’s pretty straightforward to defend against, once you know what you're looking for. Here's what to put in place:
- Treat Your Contact Form as Part of Your Security Surface
Your Contact Us form is an effective marketing tool. But since attackers see it as an entry point, it’s vital to shift how your team views such inquiries.
Before engaging, take a moment to verify. Does the company they claim to represent actually exist? Does the domain match exactly? A quick browser search and a look at the company's real website can reveal a lot. - Strengthen Your Endpoint Protection
Even the most savvy person can occasionally be caught unaware. That’s where Advanced Endpoint Detection and Response (EDR) tools come in. Unlike traditional antivirus software, which only looks for old, known threats, EDR acts like an active security guard monitoring for suspicious behaviour in real-time. This allows it to stop brand-new attacks before they can cause damage. (Note: This month's Service Spotlight covers one of the most effective EDR tools available for Canadian SMBs). - Add Email Security with Attachment Sandboxing
To stop these attacks, talk to us about email gateways with sandboxing capability. It’s like a digital bomb squad for your inbox, automatically intercepting and detonating suspicious files in an isolated cloud environment before they reach your team.
The Bottom Line: Contact form phishing is effective because it looks like normal business. Match that reality with modern awareness training and security tools that catch what human instinct can't.
Service Spotlight
Huntress: The Security Team Working for You Around the Clock
In this month's Bulletproof Your Business, we mentioned that EDR (Endpoint Detection and Response) tools are specifically designed to catch threats that traditional antivirus would miss. Huntress is the EDR solution allCare IT deploys for clients. What makes it different?
Beyond Antivirus — Why It Matters
Traditional antivirus software works by recognizing previously identified malware. Huntress takes a fundamentally different approach by watching for suspicious behaviour.
What’s the difference? Which of the following do you think would be more effective?
- a police officer who only arrested suspects already in a book of mugshots
- a constable who acted whenever he observed potentially criminal activity
The answer is obvious, and that’s how Huntress EDR works. Questionable behaviour like a file modifying system settings, or applications doing things they have no business doing is flagged and investigated by a 24/7 AI-assisted Security Operations Centre (SOC).
A 24/7 Security Operations Centre in Your Corner
For a Canadian SMB, that's a significant advantage. You get the calibre of security monitoring that was previously only available to large enterprises—without needing an in-house security team to manage it.
The Bottom Line: Huntress EDR finds the threats that got past your first line of defence—and the SOC behind it makes sure they don't go any further.
→ Want to know if your current endpoint protection would catch a contact form phishing attack? Talk to the allCare IT team—we're happy to take a look.